Build and release next MODEL (aka major) version 15-0-0 of Secure schemas

Purpose

Identify, build and release the next major version of the Secure schemas.

Currently each new field to the report is added as an optional field. At some point, these fields be added as required in the schema if it makes sense to do so. Similarly there are fields that can be deprecated, deprecated fields can be removed, and constraints of certain fields may also change.

Each change should be evaluated for the impact to groupthreat insights and sectionsec analyzers. Changes will be implemented and merged when stakeholders are ready.

How to contribute MRs

See #339812 (comment 847042725)

Proposed schema changes

Acceptance for each group is given by their representative using the following emoji: ✅ (accepted), ⚠ (no choice), ❌ (rejected).

Quorum for section-wide consensus is TBD.

Field	Change	Affects schemas	Impact on groupthreat insights / Rails	Impact on sectionsec / Analyzers	TI	CS	DAST	SCA	SAST
scan (done in v15_wip)	Mark as required	all	None, scan is already optionally parsed	Must produce scan object, most do this already	✅	✅	✅	✅	✅
scan.analyzer (done in v15_wip)	Mark as required	all	None, analyzer is already optionally parsed	Must produce scan.analyzer object, most don't do this already	✅	✅	✅	✅	✅
scan.scanner	Remove	all	👇	👇	❌	❌	❌	❌	❌
scan.scanners[]	New field	all	Rails will need to parse it if it exists, and save many scanners per scan, not just one. Tracking must be updated to track many scanners. UI must be updated to show a list.	Must replace scan.scanner with scan.scanners[], ensure scan.scanner[] contains information about scanners, not the analyzer	❌	❌	❌	❌	❌
vulnerabilities[].cve (done in v15_wip)	Remove field, remove from required	all	TBD	👇	✅	✅	✅	✅	✅
vulnerabilities.id (done in v15_wip)	Mark as required	all	None, field is already parsed	Must produce vulnerabilities[].id	✅	✅	✅	✅	✅
vulnerabilities[].scanner (done in v15_wip)	Remove field, remove from required	all	TBD, will need to rely on scan.analyzer	Should remove field	✅	✅	✅	✅	✅
vulnerabilities[].category (done in v15_wip)	Remove field, remove from required	all	TBD, will need to rely on scan.type	Should remove field	✅	✅	✅	✅	✅
vulnerabilities[].discovered_at (done in v15_wip)	Remove field (see comment)	dast	None, the field is not parsed	DAST analyzers will need to update the format of the field	✅	✅	✅	✅	✅
headers[].value in the following places in vulnerabilities[].evidence: request, response, supporting_messages.request, supporting_messages.response (done in v15_wip)	Remove minLength: 1 constraint as HTTP spec allows empty values	dast	TBD	DAST analyzers should remove filtering of headers with empty value	✅	✅	✅	✅	✅
vulnerabilities[].confidence (done in v15_wip)	Remove field, remove from required	all	TBD	Should remove field	✅	✅	✅	✅	✅
vulnerabilities[].message (done in v15_wip)	Remove field, remove from required	all	Update references to rely off name in shorted form, truncated description for longer needs	Should remove field	✅	✅	✅	✅	✅
vulnerabilities[].name (done in v15_wip)	Add maxLength constraint	all	None	None, but should align with Rails field limits	✅	✅	✅	✅	✅
vulnerabilities[].description (done in v15_wip)	Add maxLength constraint	all	None	None, but should align with Rails field limits	✅	✅	✅	✅	✅
$id (done in v15_wip)	New field (see comment)	all	None	None	✅	✅	✅	✅	✅
scan.start_time, scan.end_time (done in v15_wip)	Update pattern (see comment)	all	None	None	✅	✅	✅	✅	✅
dependency.version (done in v15_wip)	Mark as required	dependency_scanning	None	None	✅	✅	✅	✅	✅
dependency.package (done in v15_wip)	Mark as required	dependency_scanning	None	None	✅	✅	✅	✅	✅
dependency.package.name (done in v15_wip)	Mark as required	dependency_scanning	None	None	✅	✅	✅	✅	✅